@@ -1,11 +1,12 @@
1−google_auth_proxy
1+oaut2_proxy
22=================
33
4+(This project was formerly known as Google Auth Proxy)
45
5−A reverse proxy that provides authentication using Google and other OAuth2
6−providers to validate individual accounts, or a whole google apps domain.
6+A reverse proxy that provides authentication using Providers (Google, Github, and others)
7+to validate individual accounts, or a whole email domain.
78
8−[](http://travis-ci.org/bitly/google_auth_proxy)
9+[](http://travis-ci.org/bitly/oauth2_proxy)
910
1011
1112
@@ -13,19 +14,19 @@ providers to validate individual accounts, or a whole google apps domain.
1314## Architecture
1415
1516```
16− _______ ___________________ __________
17− |Nginx| ----> |google_auth_proxy| ----> |upstream|
18− ------- ------------------- ----------
19− ||
20− \/
21− [google oauth2 api]
17+ _______ ______________ __________
18+ |Nginx| ----> |oauth2_proxy| ----> |upstream|
19+ ------- -------------- ----------
20+ ||
21+ \/
22+ [provider OAuth2 API]
2223```
2324
2425
2526## Installation
2627
27−1. Download [Prebuilt Binary](https://github.com/bitly/google_auth_proxy/releases) or build from `master` with `$ go get github.com/bitly/google_auth_proxy` which should put the binary in `$GOROOT/bin`
28−2. Register an OAuth Application with Google
28+1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) or build from `master` with `$ go get github.com/bitly/oauth2_proxy` which should put the binary in `$GOROOT/bin`
29+2. Register an OAuth Application with a Provider
29303. Configure Google Auth Proxy using config file, command line options, or environment variables
30314. Deploy behind a SSL endpoint (example provided for Nginx)
3132
@@ -33,7 +34,7 @@ providers to validate individual accounts, or a whole google apps domain.
3334
3435You will need to register an OAuth application with Google (or [another
3536provider](#providers)), and configure it with Redirect URI(s) for the domain
36−you intend to run `google_auth_proxy` on.
37+you intend to run `OAUTH2_PROXY` on.
3738
3839For Google, the registration steps are:
3940
@@ -43,7 +44,7 @@ For Google, the registration steps are:
4344 * The Application Type should be **Web application**
4445 * Enter your domain in the Authorized Javascript Origins `https://internal.yourcompany.com`
4546 * Enter the correct Authorized Redirect URL `https://internal.yourcompany.com/oauth2/callback`
46− * NOTE: `google_auth_proxy` will _only_ callback on the path `/oauth2/callback`
47+ * NOTE: `oauth2_proxy` will _only_ callback on the path `/oauth2/callback`
47484. Under "APIs & Auth" choose "Consent Screen"
4849 * Fill in the necessary fields and Save (this is _required_)
49505. Take note of the **Client ID** and **Client Secret**
@@ -59,19 +60,19 @@ For LinkedIn, the registration steps are:
5960
6061## Configuration
6162
62−`google_auth_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
63+`oauth2_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
6364
6465### Config File
6566
66−An example [google_auth_proxy.cfg](contrib/google_auth_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/google_auth_proxy.cfg`
67+An example [OAUTH2_PROXY.cfg](contrib/oauth2_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/oauth2_proxy.cfg`
6768
6869### Command Line Options
6970
7071```
71−Usage of google_auth_proxy:
72+Usage of oauth2_proxy:
7273 -authenticated-emails-file="": authenticate against emails via file (one per line)
73− -client-id="": the Google OAuth Client ID: ie: "123456.apps.googleusercontent.com"
74− -client-secret="": the OAuth Client Secret
74+ -client-id="": the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
75+ -client-secret="": the Client Secret
7576 -config="": path to config file
7677 -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*
7778 -cookie-expire=168h0m0s: expire timeframe for cookie
@@ -105,12 +106,12 @@ See below for provider specific options
105106
106107### Environment variables
107108
108−The environment variables `GOOGLE_AUTH_PROXY_CLIENT_ID`, `GOOGLE_AUTH_PROXY_CLIENT_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_DOMAIN` and `GOOGLE_AUTH_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.
109+The environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.
109110
110111### Example Nginx Configuration
111112
112−This example has a [Nginx](http://nginx.org/) SSL endpoint proxying to `google_auth_proxy` on port `4180`.
113−`google_auth_proxy` then authenticates requests for an upstream application running on port `8080`. The external
113+This example has a [Nginx](http://nginx.org/) SSL endpoint proxying to `oauth2_proxy` on port `4180`.
114+`oauth2_proxy` then authenticates requests for an upstream application running on port `8080`. The external
114115endpoint for this example would be `https://internal.yourcompany.com/`.
115116
116117An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
@@ -136,10 +137,10 @@ server {
136137}
137138```
138139
139−The command line to run `google_auth_proxy` would look like this:
140+The command line to run `oauth2_proxy` would look like this:
140141
141142```bash
142−./google_auth_proxy \
143+./oauth2_proxy \
143144 --google-apps-domain="yourcompany.com" \
144145 --upstream=http://127.0.0.1:8080/ \
145146 --cookie-secret=... \
@@ -151,7 +152,7 @@ The command line to run `google_auth_proxy` would look like this:
151152
152153## Endpoint Documentation
153154
154−Google Auth Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated.
155+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated.
155156
156157* /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
157158* /ping - returns an 200 OK response
@@ -161,17 +162,18 @@ Google Auth Proxy responds directly to the following endpoints. All other endpoi
161162
162163## Logging Format
163164
164−Google Auth Proxy logs requests to stdout in a format similar to Apache Combined Log.
165+OAuth2 Proxy Proxy logs requests to stdout in a format similar to Apache Combined Log.
165166
166167```
167168<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
168169```
169170
170−## <a name="providers"></a>Providers other than Google
171+## <a name="providers"></a>Providers
171172
172−Other providers besides Google can be specified by the `providers` flag/config
173+Authentication providers can be specified by the `providers` flag/config
173174directive. Right now this includes:
174175
176+* `google` - (default) [Google](https://console.developers.google.com/project)
175177* `myusa` - The [MyUSA](https://alpha.my.usa.gov) authentication service
176178 ([GitHub](https://github.com/18F/myusa))
177179* `linkedin` - The [LinkedIn](https://developer.linkedin.com/docs/signin-with-linkedin) Sign In service.